How to only use the remote introspection

[chanxl009 (Jason Xu)]

Hi Team,

I’m trying to just use the remote introspection for OKTA.
I created a SPA application with PKCE. It only has the client id but no client secret.
When I configured the remote introspection inforamtion in the external authorization server, I don’t know which client secret should be input. If I leave it blank, the page doesn’t le me save.
So I just input another okta web app’s client secret.

but I alway got the error message as below:
“UnAuthorized application request”

If I remove the remote introspection information and input the local introspection information, I can get the correct result, no error “UnAuthorized application request”.

Any idea how to configure the correct remote introspection for okta SPA with PKCE?

Thanks & Regards,
Jason

[rmg]

Hi Jason,

Please take a look on this thread/article and it should help further with OKTA specific topic also:

doubt about "Securing APIs using 3rd party OAuth 2 provider in API Gateway"

Greeting! We refer to the article as below: https://techcommunity.softwareag.com/web/guest/pwi...0provider%20in%20API%20Gateway Doubt: 1, regarding Remote introspection, the gateway user, client id and client secret should be provided but not sure which value should be put. the gateway user should be added in the okta? client id and client secret is the ones that we can find in the okta application with type web? 2, we have published the API and the gateway endpoint is “http://.gateway.webme…

http://techcommunity.softwareag.com/pwiki/-/wiki/Main/Securing%20APIs%20using%203rd%20party%20OAuth%202%20provider%20in%20API%20Gateway

HTH,
RMG